rzen
16c10d61c3
The tombstone model is retired wholesale: deletion is a move into the reserved <root>/.trash/, always entering at the top (rank minting — no deleted: key, no timestamp sort), with modified stamped for the future age-based purge. Lanes are never trashed — lane delete is physical, native undo in-session the net. Put Back is gone: restore is drag-out or cut+paste (⌘X now enabled in the trash as the keyboard restore path). Trash cards are ordinary cards — search, selection, clipboard, and rendering uniform — and one container boundary replaces the effective-liveness, ancestor-walk, and kind-homogeneity machinery across 02 and 04. Delete stages by place (board moves, trash deletes permanently under the recoverability confirm); legacy deleted: keys migrate without destroying (cards relocate, lanes return live, notices). Templates exclude .trash; Duplicate carries it; the agent guide teaches delete-as-move. Materialized reserved lanes are named as a pattern — .archive is WISHLIST #8, and the backed-out release-presentation question is marked open in 03. Ruling: Redesign board Resolved card e8f1a6c2; 19 mooted tombstone-era rulings moved to the board's new Mooted lane. Claude-Session: https://claude.ai/code/session_01CqjXB7ASoWtbyoGod68k97
28 lines
6.4 KiB
Markdown
28 lines
6.4 KiB
Markdown
# Native Undo (base edition)
|
|
|
|
The undo/redo substrate for base Lanework (12-editions.md), filling the one gap mode:none admits (06-history-undo.md, 07-sync-collab.md): boards without git had no undo. Pro's substrate remains git (06); this doc never applies there. The design problem is not NSUndoManager itself — it is native undo over **files-are-truth**: the disk can change underneath the stack, because the app is not the only writer.
|
|
|
|
## Rules
|
|
|
|
- **One stack per board, owned by the board session.** Not per-window: every window over a board (board window, its card windows) shares the store and shares the stack. `window.undoManager` for board surfaces returns the session's manager; 06 ▸ Undo routing applies unchanged — text-editing surfaces get their session-scoped text undo, everywhere else ⌘Z/⇧⌘Z hit the board stack. Undo is board-local, exactly as git undo was.
|
|
- **Registration at the Writer boundary.** Every app-mediated mutation already passes through the Writer as a `WriteOperation` (02-architecture.md) — that closed enum is the exact inventory of undoable operations. Each Writer call site registers the inverse operation, computed from the pre-write snapshot the store already holds: move → move back (original lane, original `order`); reorder → restore original `order`; rename → restore title; restyle → restore prior style; resize → restore prior width; Edit-session body save → restore prior body bytes; card delete (⌫) → move back out of `.trash/`; restore-by-move → move back in; lane delete → recreate the folder from the registered inverse; create → remove the created folder.
|
|
- **What is not undoable** (settled): **Permanently delete** (Delete Immediately, Empty Trash) — `purgeIsUnrecoverable` stays true in base, and the existing confirmation rule (03-board-ui.md) already fires on all base boards, since none have git history: the confirm *is* the safety. **Repair** (01-storage-format.md's duplicate-id remint) — undoing a remint would recreate the duplicate id the operation exists to remove. Both match their existing "destructive, confirmed, final" posture.
|
|
- **Coalescing follows commit granularity** (settled): one gesture, one undo step — a multi-card move is one step with a plural title; an Edit session is one step, registered at the Edit→Preview flip (the effective Save — 05-card-window.md); a styling batch is one step (03's one-gesture-one-commit rule, substrate swapped). The 06 vocabulary supplies menu titles ("Undo Move 3 Cards"), via NSUndoManager's dynamic retitling — the same naming machinery both editions use.
|
|
- **Session-only persistence** (settled): the stack lives with the board session and dies at close/quit — standard macOS behavior. Git undo's survive-relaunch property is a Pro difference, stated honestly (12's matrix).
|
|
- **Foreign writes never join the stack** (settled): NSUndoManager can only undo what the app mediated. An agent's or hand edit is not a step — the honest capability gap vs Pro (12's matrix). Foreign changes also do not clear the stack wholesale; collisions are handled lazily, per step, by validation:
|
|
- **Staleness validation before every apply** (settled): an inverse operation re-checks its target against the current snapshot at ⌘Z time. **The predicate is field-level** (settled — ruled 2026-07-27): each step registers both sides of its write anyway (the before-value is the inverse; the after-value is what its write set), so validation compares the targeted field's current value against the expected after-value — nearly free, and truer to never-surprise-the-file than an existence-only check (an inverse rename must not clobber a foreign rename on a still-existing card; body steps compare bytes). Target folder gone, or the field no longer holding the step's after-value → the step is **skipped, not applied**: popped from the stack with an info-tone banner ("Undo skipped — 'Fix login' changed outside Lanework"), and ⌘Z falls through to the next step. Never apply a stale inverse on top of someone else's newer write. **Invalidation is lazy** (settled — ruled 2026-07-27): staleness is discovered at ⌘Z time, never by background pruning — the EchoLedger's foreign diffs do not eagerly drop colliding steps. The stack always looks full; with the field-level predicate a skip fires only on a genuine per-field collision, and a skipped step's banner explains itself, where eager pruning would shrink the stack invisibly mid-session.
|
|
- **Locks disable the stack** (settled): every read-only lock (vanished root, failed reload after wholesale ops, unwritable location — 02-architecture.md) disables Undo/Redo with the other mutating commands; the stack itself survives the lock and resumes when it clears. Steps landed before a lock validate like any other at apply time.
|
|
|
|
## Interaction with the trash
|
|
|
|
⌫'s undo is the move back — a card delete is a move into `.trash/` (resettled 2026-07-28), so its undo is the ordinary inverse move, returning the card to its source lane and rank; a restore-by-move undoes the same way in reverse. The stack and the trash never conflict — they are the same folder moves addressed by recency instead of by selection. A **lane delete's undo recreates the folder** from the registered inverse (the one destructive delete — in-session only, which is the accepted net; git boards additionally keep it in history), and a permanent card delete undoes the same way.
|
|
|
|
## Out of scope
|
|
|
|
- **Attachment operations, v1** (deferred — ratified 2026-07-27): attach → remove is a clean inverse, but remove-attachment → re-add requires the removed file to survive somewhere (a staging area with a lifecycle — App Support, bounded, its own cleanup rules; possibly shared with 04 ▸ Clipboard's staging). The deferral is the ruling: attachment add/remove registers **no undo step** in v1 (the operations remain, as today, confirmed-or-benign); the staging design pass reopens post-2.0.
|
|
- **EchoLedger-synthesized foreign undo** (deferred, wishlist — WISHLIST.md item 6): the ledger already classifies foreign diffs for announcements; it could synthesize inverse operations and push foreign steps onto the stack, narrowing the gap to Pro. Real design needed (ordering vs app steps, attribution, user expectations) — not assumed by this doc.
|
|
|
|
## Open questions
|
|
|
|
None currently — the staleness predicate (field-level) and invalidation timing (lazy) were ruled 2026-07-27 and are settled in Rules above.
|